Re: Problems with auditd -- resolved

2006-09-25 Thread Robert Watson
On Sat, 23 Sep 2006, Robert Watson wrote: Right now the id(1) command in -STABLE doesn't print audit properties of the process, but I've attached a patch that causes it to do so when id -a is run. If you could apply this patch and run id -a as root, that would be helpful. I've merged this

Re: Problems with auditd -- resolved

2006-09-23 Thread Robert Watson
On Fri, 22 Sep 2006, Joerg Pernfuss wrote: On Sun, 17 Sep 2006 09:19:03 +0100 (BST) Robert Watson [EMAIL PROTECTED] wrote: I've just comitted a fix to syscalls.master and regenerated the remaining system call files, which should correct the auditctl: Invalid Argument error being returned by

Re: Problems with auditd -- resolved

2006-09-21 Thread Joerg Pernfuss
On Sun, 17 Sep 2006 09:19:03 +0100 (BST) Robert Watson [EMAIL PROTECTED] wrote: Dear all, I've just comitted a fix to syscalls.master and regenerated the remaining system call files, which should correct the auditctl: Invalid Argument error being returned by auditd. In short order, this

Re: Problems with auditd -- resolved

2006-09-18 Thread Ganbold
Robert Watson wrote: Dear all, I've just comitted a fix to syscalls.master and regenerated the remaining system call files, which should correct the auditctl: Invalid Argument error being returned by auditd. In short order, this fix should be on the cvsup mirrors -- please let me know if

Re: Problems with auditd -- resolved

2006-09-18 Thread Robert Watson
On Mon, 18 Sep 2006, Ganbold wrote: # # $P4: //depot/projects/trustedbsd/openbsm/etc/audit_user#3 $ # $FreeBSD: src/contrib/openbsm/etc/audit_user,v 1.2.2.1 2006/09/02 10:46:00 rwatson Exp $ # #root:lo:no root:all:no I'm bit confused here I thought auditd should log all activities, but I

Re: Problems with auditd -- resolved

2006-09-18 Thread Ganbold
Robert Watson wrote: On Mon, 18 Sep 2006, Ganbold wrote: # # $P4: //depot/projects/trustedbsd/openbsm/etc/audit_user#3 $ # $FreeBSD: src/contrib/openbsm/etc/audit_user,v 1.2.2.1 2006/09/02 10:46:00 rwatson Exp $ # #root:lo:no root:all:no I'm bit confused here I thought auditd should log all

Re: Problems with auditd -- resolved

2006-09-18 Thread Robert Watson
On Mon, 18 Sep 2006, Ganbold wrote: Strange, there are still no logs in /var/audit dir :( Even tried to use your config, no success. However when I logged on to my desktop from console to itself (ssh -l tsgan localhost) it starts logging. But why it is not logging when I'm on console? Are

Re: Problems with auditd -- resolved

2006-09-18 Thread Ganbold
Robert Watson wrote: On Mon, 18 Sep 2006, Ganbold wrote: Strange, there are still no logs in /var/audit dir :( Even tried to use your config, no success. However when I logged on to my desktop from console to itself (ssh -l tsgan localhost) it starts logging. But why it is not logging when

Re: Problems with auditd -- resolved

2006-09-18 Thread Robert Watson
On Mon, 18 Sep 2006, Ganbold wrote: Robert Watson wrote: On Mon, 18 Sep 2006, Ganbold wrote: Strange, there are still no logs in /var/audit dir :( Even tried to use your config, no success. However when I logged on to my desktop from console to itself (ssh -l tsgan localhost) it starts

Re: Problems with auditd -- resolved

2006-09-18 Thread Cristiano Deana
2006/9/18, Robert Watson [EMAIL PROTECTED]: I'm bit confused here I thought auditd should log all activities, but I don't see any log files. Am I doing something wrong here or my understanding regarding auditd is wrong? Your configuration looks right to me, and should be generating a

Problems with auditd -- resolved

2006-09-17 Thread Robert Watson
Dear all, I've just comitted a fix to syscalls.master and regenerated the remaining system call files, which should correct the auditctl: Invalid Argument error being returned by auditd. In short order, this fix should be on the cvsup mirrors -- please let me know if it resolves the problem

Re: Problems with auditd -- resolved

2006-09-17 Thread Cristiano Deana
2006/9/17, Robert Watson [EMAIL PROTECTED]: I've just comitted a fix to syscalls.master and regenerated the remaining system call files, which should correct the auditctl: Invalid Argument error being returned by auditd. In short order, this fix should be on the cvsup mirrors -- please let me